Package io.jenkins.plugins.github_pr_approval

Class PendingApprovalAction.ApprovalQueueGuard

java.lang.Object
hudson.model.Queue.QueueDecisionHandler
io.jenkins.plugins.github_pr_approval.PendingApprovalAction.ApprovalQueueGuard
All Implemented Interfaces:
ExtensionPoint
Enclosing class:
PendingApprovalAction
@Extension public static class PendingApprovalAction.ApprovalQueueGuard extends Queue.QueueDecisionHandler
The gate that stops an unapproved fork pull request from building. The job is left enabled with a "pending approval" banner, so this — not a disabled flag — is the only thing enforcing the policy.

Jenkins asks every Queue.QueueDecisionHandler before it queues anything, so refusing here blocks the build no matter what triggered it: a scan, a webhook, a re-trigger, or a manual "Build Now". The one exception is a build that a person who may approve the PR started themselves; that build is let through as a one-off, without recording an approval, so the PR still waits for everyone else.

It runs while the build queue is locked, so it stays deliberately cheap: a few in-memory checks and one small file read — never a GitHub call and never a write. The extra permission check runs only for a build that would otherwise be blocked and carries a real user, so the hot branch-indexing path never pays for it.